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CONTROL UNIT 



Background Information 

The present invention is directed to a control unit of the type set forth in the independent 
claim. 

From DE 101 23 839 Al, it is known to provide for data transmission, here via SPI (Serial 
5 Peripheral Interface), in a control unit between a processor and at least one further circuit, in 
particular, ASIC's. The processor outputs the clock pulse to the ASIC's. The processor 
derives the clock pulse from the oscillation of a system oscillator, such as a pierce oscillator. 

Summary of the Invention 

The inventive control unit having the features of the independent claim has the advantage 
1 0 over the related art that the processor in the control unit, preferably a microcontroller, now 
monitors the clock pulse based on output signals of at least two clock outputs. This 
monitoring can be carried out by hardware and/or software. A monitoring signal is generated 
as a function of the monitoring, said monitoring signal being usable for input into a fault 
memory and/or for outputting a warning, for example, via a warning light. However, the fault 
15 in question can also be output on a display in the vehicle. The monitoring signal can even be 
used to transmit a radio transmission to a remote maintenance center, so that the fault is 
communicated to the remote maintenance center, which can inform the driver to have a 
corresponding repair carried out. It is possible to use more than two clock outputs, and 
thus, the corresponding output signals to monitor the clock pulse. This provides high 
20 safety against clock signal errors, which may provoke failures of the airbag control unit. 

Advantageous improvements of the control unit set forth in the independent claim are 
made possible by the measures and refinements specified in the dependent claims. 

A particular advantage is that the clock outputs are connected in such a manner that the 
control unit generates a monitoring signal as a function of the output signals from the 
25 clock outputs. Preferably, the circuit is configured such that the outputs are connected to 
an exclusive-OR element so that when one clock output no longer matches the other clock 
output with respect to its output signal, the exclusive-OR element produces an output 
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signal, thus indicating a fault. This is a particularly simple and reliable hardware circuit 
for fault indication. 

It is also advantageous that the clock outputs are fed back to inputs of the processor, so 
that the processor itself can monitor the output signals of the clock outputs. Thus, for 
5 example, the processor is able to perform monitoring in terms of amplitude, and also to 
simulate the exclusive-OR function by means of software. Given an appropriate 
redundant system clock design, the separate monitoring of the output signals allows the 
control unit to continue operating, even if an output signal no longer meets the 
requirements. 

10 To this end, the at least two output signals of the two clock outputs jointly generate the 
clock pulse for the other circuits. This is most easily achieved by ORing the two clock 
output signals. The ORing can preferably be accomplished by connecting a diode in the 
forward direction to each of the two clock outputs, respectively. Then, the diodes are 
connected together on the other side, so that ORing is performed. The clock signal 

1 5 generated in this manner can then be further processed by an impedance transformer 
and/or an amplifier; the impedance transformer being intended to minimize the load on 
the clock signals, and the amplifier being intended to suitably amplify the clock signal. 

A further advantage is that the two clock outputs are assigned to different port groups, 
just as the two inputs which are intended for monitoring the output signals of the clock 
20 outputs. This separation into different port groups means an enlarged distance between 
the circuit groups on the chip, so that in the event of hardware damage of one output or 
input, the other output or input is not affected by this. This increases the safety of the 
system. 

Brief Description of the Drawing 

25 An exemplary embodiment of the present invention is depicted in the drawing and will be 
explained in greater detail in the following description. 

In the drawing, 

Figure 1 is a block diagram of the control unit according to the present invention. 
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Detailed Description 

.%•> 

Control units, especially for controlling passenger protection devices, such as airbags, belt 
pretensioners, or roll bars, must be highly reliable so as to prevent internal failures resulting 
in unwanted situations for vehicle passengers. For data transmission between the 
5 microcontroller in the control unit and the connected components in the control unit, the so- 
called ASIC's, such as a firing circuit control system, or the sensors or interface modules, the 
SPI (Serial Peripheral Interface) is frequently used. In this instance, a line MOSI (Master Out 
Slave In) is used by the microcontroller to transmit data to the connected components, and an 
additional line MISO (Master In Slave Out) is used to allow the connected ASIC's to transmit 
10 data to the microcontroller. The lines in question are separate. The serial peripheral interface 
has still further lines, such as the chip-select line and the clock line. These are indeed separate 
hardware lines. The /xC controller provides this clock pulse via the clock lines to the 
connected ASIC's, resulting in a synchronous data transmission. It is now clear that a clock 
signal error may result in faults in the functioning of the control unit. 

15 Therefore, in accordance with the present invention, the clock signal is monitored based on 
the output signals of two clock outputs of the microcontroller, which can also be a different 
processor. This monitoring can be carried out by hardware or software. For hardware-based 
implementation, it is possible to use, for example, an exclusive-OR (non-equivalence) 
element, whereas in the case of software-based monitoring, the microcontroller itself is used 

20 by feeding the output signals of the clock outputs back to inputs of the microcontroller. The 
software-based implementation has the advantage that the individual output signals can be 
monitored separately. In addition, when using two clock outputs, higher redundancy for the 
clock generation can be achieved by preferably ORing the outputs which supply the clock 
signal. 

25 Figure 1 is a block diagram of the control unit according to the present invention. The block 
diagram concentrates only on the essential elements of the present invention, so that other 
components which are also present in the device are not shown for the sake of simplicity. A 
microcontroller /xC is connected via a data output MOSI to ASIC's 1, 2 and n present in the 
control unit. Line MOSI is used for data transmission from fiC to ASIC's 1, 2 and n. 

30 Microcontroller /xC is also connected to ASIC's 1, 2 and n via a data input. Here, however, 
lines MISO is used for data transmission of the ASIC's to the microcontroller. The data 
transmission between the microcontroller and ASIC's 1, 2 and n can take place virtually in 
parallel. Via further outputs 10 and 1 1, clock signals of microcontroller |iC are output, said 
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clock signals being generated by microcontroller |aC by dividing an oscillator signal. 
Oscillators that can be used here include, for example, a pierce oscillator which can easily be 
set into oscillation and delivers a stable clock signal. Clock outputs 10 and 1 1 are connected 
to diodes Dl and D2, respectively; the diodes, in turn, being interconnected to an input of an 
5 amplifier V. Amplifier V then delivers the clock pulse SCKr. This clock pulse then goes to 
components ASIC 1, ASIC 2 and ASIC n. Thus, microcontroller jiC and ASICs 1, 2 through 
n operate in parallel with respect to processing. 

However, the output signals of clock outputs 10 and 1 1 are each also supplied to inputs of an 
exclusive-OR element. The exclusive-OR element produces a signal at its output when the 
10 two input signals are different. This means that the exclusive-OR element produces a 1 only 
if a 0 and a 1, or a 1 and a 0 are present, otherwise it produces a 0. A warning light driver 15 
is controlled as a function of this output signal of exclusive-OR element 12. In the event of a 
fault, i.e., when the two clock signals are different, said warning light driver activates a 
warning light to indicate the fault. 

15 Alternatively or additionally, the output signals of clock outputs 10 and 1 1 can also be 

monitored by microcontroller [iC itself. To this end, the output signals are fed back to two 
inputs 13 and 14, respectively. Microcontroller \iC can then monitor the output signals by 
means of software. The microcontroller can do this, for example, by simulating the exclusive- 
OR function by means of software, and by separately monitoring the output signals in terms 

20 of amplitude. Microcontroller (iC then generates a monitoring signal as a function thereof, 
said monitoring signal being used, for example, for controlling the warning light driver. 
However, it is also possible to display a warning on a display in the vehicle. Inputs 3 and 4 
should be assigned to different port groups. Port groups are understood here to be adjacent 
inputs and outputs. Clock outputs 10 and 1 1 should also belong to different port groups in 

25 order not to be geographically adjacent so as to prevent failure of the two clock outputs in the 
event of a hardware fault. 

Instead of the SPI communication, which is a bus communication, it is also possible to use 
point-to-point connections between microcontroller jiC and the individual ASIC's, 
respectively. However, other bus communications are also possible alternatively to the SPI 
30 connection. 
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